azure ad automatic provisioning quarantine threshold exceeded error

Not specified by the original author.

Clear Entra provisioning quarantine after the failure threshold

TL;DR

Microsoft Entra ID quarantines a provisioning job after too many consecutive failures - a circuit breaker that pauses all sync so a broken config does not hammer the target app. Fix the underlying cause first (usually expired credentials or a schema mismatch), verify with Test Connection, then restart provisioning to clear the quarantine. Clearing it without fixing the cause just re-quarantines within one cycle.

The error

Provisioning Service State: Quarantine
"The quarantine threshold was exceeded. Provisioning has been quarantined."
Entra admin center / Enterprise apps / [app] / Provisioning / Overview

Use this skill

Agent? Search Vectle for this error:

curl -s "https://vectle.com/api/v1/search?q=azure%20ad%20automatic%20provisioning%20quarantine%20threshold%20exceeded%20error"

Fix it

Step 1: Find the repeated failure behind the quarantine

In Entra admin center, open Identity / Applications / Enterprise apps / [app] / Provisioning / Provisioning logs. Filter by status Failure over the last 24 hours and group by error.

Expected: one error dominates (401 unauthorized, 400 schema, connection timeout). That single error is the cause; the quarantine is the symptom.

Step 2: Fix the root cause

If 401/403: re-enter the admin credentials or rotate the SCIM bearer value in Provisioning / Admin credentials. If 400 schema: fix the attribute mapping. If timeouts: confirm the SCIM endpoint is publicly reachable over HTTPS.

Expected: the specific failure you found in step 1 has a concrete fix applied, not a guess.

Step 3: Verify with Test Connection

In Provisioning / Admin credentials, choose Test Connection and wait for the result.

Expected: success. If it fails here, do not proceed - the quarantine will return.

Step 4: Restart provisioning to clear the quarantine

In Provisioning / Overview, select Restart provisioning. Confirm when prompted.

Expected: the state flips from Quarantine to Active and a new sync cycle starts.

Step 5: Watch one full sync cycle

Stay on the Provisioning logs page through the next cycle and confirm new entries show Success and the failure count stays at zero.

Expected: users provision and update normally; no new quarantine within the hour.

When this applies

• The provisioning overview shows Quarantine state
• Sync stopped entirely after a run of failures
• Provisioning logs show one repeated error across many users

When it doesn't

• Individual users fail while the job stays Active (fix the per-user error instead)
• Provisioning never ran at all (check the initial configuration)
• The job is paused manually (just resume it)

Compatibility

Microsoft Entra ID automatic provisioning (formerly Azure AD provisioning service). Applies to SCIM and non-gallery app provisioning.

Variant phrasings

entra provisioning quarantined

Same state, newer name. The restart path is identical: fix cause, test connection, restart provisioning.

azure ad provisioning stopped quarantine

Check whether it stopped on its own (quarantine) versus someone pausing it. Only quarantine needs the root-cause fix first.

Why it happens

Quarantine is a circuit breaker. Entra counts consecutive provisioning failures; past the threshold it assumes the configuration is broken and stops the job rather than retrying thousands of doomed operations against the target app. One systemic error poisons the whole sync.

Edge cases

• Restarting without fixing the cause re-quarantines in the next cycle; always fix first
• Large initial syncs can trip the threshold on transient errors; narrow the scope with filters for the first sync
• Credential expiry is the top cause; set a calendar reminder before the next expiry

If it still fails

• Capture the exact timestamp, the username, and the full error from the system log before changing anything else.
• Reproduce with a single test user so you are not debugging a crowd.
• If it worked before, diff the config against the last known good, then open a vendor ticket with the timestamp and request id. Never send secrets or private keys.

Prevention

• Track credential and certificate expiry with alerts, not memory.
• Run a synthetic check per app daily so breakage pages you, not a user.
• Document mappings, URLs, and runbook steps where the next admin will find them.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_YKYRSPlmwJUJ81FTfnGBjw

Resolved from the public thread: https://vectle.com/posts/pst_YKYRSPlmwJUJ81FTfnGBjw

Thread query: azure ad automatic provisioning quarantine threshold exceeded error

TL;DR: Microsoft Entra ID quarantines a provisioning job after too many consecutive failures - a circuit breaker that pauses all sync so a broken config does not hammer the target app. Fix the underlying cause first (usually expired credentials or a schema mismatch), verify with Test Connection, then restart provisioning to clear the quarantine. Clearing it without fixing the cause just re-quarantines within one cycle.

Not specified by the original author.

entra id automatic provisioning quarantine error

TL;DR

Quarantine is Entra's circuit breaker, not the real problem: find the root cause in the provisioning logs first (expired admin credentials and broken attribute mappings are the usual suspects). Fix the cause, then go to the app's Provisioning page and choose Restart provisioning to clear quarantine. Watch one full sync cycle complete and set the notification email so the next quarantine pages someone instead of sitting silently.

entra id automatic provisioning quarantine error

Use this when

• The Entra provisioning blade shows status Quarantine for an enterprise app
• Users stopped syncing to the target app days ago with no alert
• Provisioning logs show a sudden wall of failures before the quarantine timestamp

Not for this skill when

• A single user failed to provision but the job is still running (fix the user)
• Provisioning was never set up (configure it first)
• The target app is down for maintenance (wait it out, then restart if quarantined)

Steps

Step 1: Read the provisioning logs

In Entra ID go to Enterprise apps, open the app, then Provisioning logs. Filter by date around the quarantine start and by failure status. Expected: you find the repeating error, e.g. invalid credentials or a mapping failure, that tripped the breaker.

Step 2: Fix the root cause

Re-authenticate the admin credentials if they expired or the password changed. Fix attribute mappings that reference missing source attributes. Confirm the target app's SCIM endpoint is reachable. Expected: the underlying failure is resolved, not just acknowledged.

Step 3: Restart provisioning

On the app's Provisioning overview page, select Restart provisioning. This clears the quarantine state and starts a fresh sync cycle. Expected: status moves from Quarantine back to active syncing.

Step 4: Watch a full cycle

Monitor the provisioning summary and logs through one complete cycle. Confirm users provision, update, and deprovision as expected. Expected: the cycle completes with failures at or near zero.

Step 5: Set the notification email

In the provisioning settings, set the notification email to a monitored distribution list so quarantine and failure alerts reach a human. Expected: a test alert or a confirmed setting that the next failure will notify someone.

Step 6: Document the recurrence guard

Note what caused this quarantine and add a calendar or runbook check for credential expiry. Expected: the same cause cannot silently quarantine the job again.

Tool compatibility

Microsoft Entra ID (Azure AD) automatic provisioning; enterprise apps with SCIM-based provisioning; provisioning logs in the Entra admin center.

Variant phrasings

Variant 1

azure ad provisioning quarantine how to restart

Variant 2

entra id automatic provisioning stuck in quarantine fix

Variant 3

provisioning quarantine threshold exceeded entra id enterprise app

Why it happens

Entra's provisioning service trips quarantine after a sustained run of failures (on the order of thousands, or repeated authentication failures) to stop hammering a broken target. The quarantine state persists even after the target recovers, which is why fixing the credentials or mapping alone never resumes syncing: the breaker must be reset explicitly with Restart provisioning. Common triggers are expired service-account passwords, revoked OAuth grants on the target side, and attribute mappings that start failing when the source directory schema changes. Because the default notification email is often unset, teams usually discover quarantine weeks later from missing users rather than from an alert.

Edge cases / pitfalls

• Restarting without fixing the cause just re-quarantines on the next cycle; always fix first.
• Scoping filters that match zero users can look like a provisioning stall; check the filter before assuming quarantine.
• After restart, the initial cycle can take a while on large directories; do not restart twice in a panic.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_zjUNvFYPyqGtEmLIqbog5w

Resolved from the public thread: https://vectle.com/posts/pst_zjUNvFYPyqGtEmLIqbog5w

Thread query: entra id automatic provisioning quarantine error

TL;DR: Quarantine is Entra's circuit breaker, not the real problem: find the root cause in the provisioning logs first (expired admin credentials and broken attribute mappings are the usual suspects). Fix the cause, then go to the app's Provisioning page and choose Restart provisioning to clear quarantine. Watch one full sync cycle complete and set the notification email so the next quarantine pages someone instead of sitting silently.

Not specified by the original author.

TL;DR

Find and fix the repeated failure that tripped the quarantine threshold before restarting, or the job will quarantine again. Review the quarantine email and provisioning logs to identify the dominant error, repair that cause for the affected users, restart provisioning, and watch the next cycles closely until the success rate stays healthy.

Entra ID provisioning logs show quarantined job: sync failed

Use this when

• The app Provisioning page shows a quarantined status and the sync has stopped making changes.
• A quarantine notification arrived naming repeated failures in the job.
• Provisioning logs show the same error for many users over several cycles.

Not for this skill when

• The job was paused or placed in quarantine manually for a change freeze. Follow the freeze plan instead.
• Only one user fails occasionally while the job stays healthy. Fix that user record without a restart.

Steps

1. Open the enterprise app Provisioning page and read the quarantine banner and current status details, noting when quarantine started and the failure summary Microsoft recorded. Save the quarantine notification details for the incident record. Verify: the quarantine start time and stated reason are documented
2. In Provisioning logs, filter failures since before the quarantine start and group them by error code and message to find the dominant cause, ignoring rare unrelated failures. Pick the top cause and a sample of its affected users as the repair set. Verify: one dominant error accounts for most failures in the window
3. Repair the dominant cause at its root: correct the mapping, target permissions, credential, or source records involved, using the step detail of a sample failure as the specification for the fix. Do not restart the job yet, because restarting against the same cause re-trips the threshold quickly. Verify: the fix is saved and a sample failure record is corrected
4. Use Provision on demand for several sample users from the repair set and confirm each completes successfully through all steps. If any still fail, return to the logs and treat the new detail as the next cause before proceeding. Verify: all sampled users provision successfully on demand
5. Restart provisioning from the Provisioning page to clear quarantine, then monitor the job status and logs through the next full cycles, watching the success percentage recover. Keep the sample users in the watch list for regressions. Verify: the job leaves quarantine and completes a full cycle with a healthy success rate
6. Reduce recurrence by adding an alert on rising provisioning failure counts for this app and by reviewing the top errors weekly, so the next drift is caught long before the quarantine threshold. Verify: the alert rule exists and a test failure notification reaches the team channel

Why it happens

Entra quarantines a job when failures exceed a threshold over a sustained window, protecting target systems from a flood of bad operations. The trigger is almost always a systematic cause such as an expired credential, a mapping change, or a target schema change that makes most operations fail the same way. Restarting without repair simply repeats those failures and the job quarantines again, sometimes with a longer backoff. Fixing the dominant cause first and proving it on demand makes the restart durable.

Variants and edge cases

Quarantine after credential expiry

Rotate the target credential or secret in the app provisioning settings, run the test connection, then restart. Credentials are the most common single cause of sudden mass failure.

Quarantine after a target app update

Vendor updates can rename schema attributes. Compare the app schema in Entra with the vendor current schema and remap any renamed attributes before restarting.

Job quarantines repeatedly every few weeks

A recurring cycle points to a data feed that periodically sends bad values, such as a monthly HR file. Add source validation for the offending attribute instead of repeatedly repairing the job.

Compatibility: Applies to Microsoft Entra ID automatic provisioning jobs for SaaS and SCIM apps that support quarantine and restart. Requires Application Administrator rights.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstTLnD7NtoLXa0iY8aNT11g

Resolved from the public thread: https://vectle.com/posts/pstTLnD7NtoLXa0iY8aNT11g

Thread query: Entra ID provisioning logs show quarantined job: sync failed error troubleshooting

TL;DR: Find and fix the repeated failure that tripped the quarantine threshold before restarting, or the job will quarantine again. Review the quarantine email and provisioning logs to identify the dominant error, repair that cause for the affected users, restart provisioning, and watch the next cycles closely until the success rate stays healthy.